BCrypt vs Argon2 in Spring Security: When Memory Hardness Matters
BCrypt's low memory footprint leaves it vulnerable to GPU-accelerated brute force at scale, a gap that Argon2 closes by design. Teams building new Spring Boot services get a stronger default by reaching for Argon2PasswordEncoder, while those on BCrypt can stay put without immediate risk.
BCryptPasswordEncoder has been the go-to password hasher in Spring Security for years — it's mature, predictable, and requires no extra dependencies. Its single strength parameter controls CPU cost by doubling Blowfish rounds, and a 16-byte random salt is embedded directly in the 60-character output. The catch: BCrypt uses almost no memory, so attackers can still parallelize guesses across thousands of GPU cores.
Argon2PasswordEncoder, winner of the 2015 Password Hashing Competition, adds explicit memory hardness. By forcing every hash attempt to allocate a configurable amount of RAM (default 4 MB), it makes GPU and ASIC attacks economically infeasible. Spring Security ships Argon2id support since Boot 2.7, though it pulls in Bouncy Castle. The trade-off is more knobs to tune — salt length, hash length, parallelism, memory, and iterations — versus BCrypt's single strength dial.
For new projects with compliance or high-security requirements, Argon2 is the stronger choice. Existing BCrypt deployments don't need a panic migration; the algorithm remains unbroken in practice. A DelegatingPasswordEncoder lets teams support both formats during a gradual transition.
BCrypt's single strength knob is both its greatest usability feature and its architectural ceiling: you can only dial CPU cost, not memory cost, which leaves a vector open that modern hardware exploits.
The 72-byte password truncation in BCrypt is a real footgun for apps that accept passphrases; developers often don't discover it until a security review.
Argon2's five-parameter constructor offers precision but also invites misconfiguration — setting parallelism too high on a multi-tenant server can degrade performance for all users.
Spring Security's decision to bundle Argon2 support without making it the default reflects a pragmatic bet: BCrypt is good enough for most, and Argon2 is there for teams that know they need it.
The recommendation to keep a single hash verification under one second is a useful rule of thumb that applies to both algorithms and prevents login-time DoS.
Memory hardness is not a theoretical nicety — cloud GPU instances are cheap enough that BCrypt's lack of memory cost is a measurable weakness for high-value targets.